mob[.]authe[.]top

Analysis of mob.authe.top indicates a brand impersonation campaign targeting Steam users, classified as a gaming scam. The domain was registered on February 21, 2026, and is currently offline. Infrastructure analysis reveals it resolves to IP 188.114.97.3, hosted on AS13335 (Cloudflare, Inc.) in the US. The SSL certificate is graded WE1, a low-trust indicator. The page title 'Anmelden' (German for 'Log In') suggests a localized phishing attempt, though the exact content and mechanics of the scam remain unconfirmed due to the domain's offline status.

Detection data shows the domain appears on one security blocklist, and 11 of 93 security vendors on VirusTotal flagged it as malicious. Gridinsoft assigns a trust score of 0/100, reinforcing its high-risk classification. The domain is explicitly blocked by PhishDestroy. While the scam type is identified as a gaming scam impersonating Steam, no further details about the phishing kit or payload delivery mechanism are available.

Defenders should treat this domain as a confirmed threat. Recommended actions include blocking the domain and its resolving IP at perimeter security controls, monitoring for internal connections to 188.114.97.3, and reviewing logs for prior interactions. Given the domain's offline status, no active compromise is expected, but historical exposure should be assessed. If Steam credentials are suspected to have been exposed, initiate password resets and enable multi-factor authentication for affected accounts.